Legal pages feature and dorfteich.online texts #82

New Issue

fable-5 · 2026-07-04T14:52:44+02:00

fable-5 commented

2026-07-04 14:52:44 +02:00

Context

Every EU-hosted instance needs imprint and privacy pages; Dorfteich ships this as a feature (kickoff decision), and dorfteich.online uses the operator's standard texts.

Scope

Instance settings 'Legal': two Markdown fields (imprint, privacy policy) edited by Site Admins with preview; rendered at /legal/imprint and /legal/privacy (public, no auth, server-rendered like #56); footer links on all views incl. public pages and auth screens; a privacy-policy template covering Dorfteich's actual processing (accounts, sessions, rate-limit IPs, mails, uploads — from security.md §Privacy) shipped as documented default text in docs/self-hosting/legal-template.md; the operator's real texts for dorfteich.online are applied at go-live (checklist item in #89, not in the repo).

Acceptance criteria

legal pages render publicly when configured; footer links appear everywhere
unconfigured legal pages show a Site-Admin-visible warning banner (not silently missing)
template document matches the implemented processing activities (reviewed against security.md)

Technical notes

security.md §Privacy, kickoff decision (product feature + operator texts).

Dependencies

Depends on #19, #56.

Size: ~1 day

Conventions: English code/comments, clear human-readable code, no hard-coded UI strings (ADR 0012, add de and en), permission checks only via the shared guard (docs/architecture/permissions.md). Read the referenced ADRs before starting.

## Context Every EU-hosted instance needs imprint and privacy pages; Dorfteich ships this as a feature (kickoff decision), and dorfteich.online uses the operator's standard texts. ## Scope Instance settings 'Legal': two Markdown fields (imprint, privacy policy) edited by Site Admins with preview; rendered at `/legal/imprint` and `/legal/privacy` (public, no auth, server-rendered like #56); footer links on all views incl. public pages and auth screens; a privacy-policy template covering Dorfteich's actual processing (accounts, sessions, rate-limit IPs, mails, uploads — from security.md §Privacy) shipped as documented default text in `docs/self-hosting/legal-template.md`; the operator's real texts for dorfteich.online are applied at go-live (checklist item in #89, not in the repo). ## Acceptance criteria - [ ] legal pages render publicly when configured; footer links appear everywhere - [ ] unconfigured legal pages show a Site-Admin-visible warning banner (not silently missing) - [ ] template document matches the implemented processing activities (reviewed against security.md) ## Technical notes - security.md §Privacy, kickoff decision (product feature + operator texts). ## Dependencies Depends on #19, #56. **Size**: ~1 day --- *Conventions: English code/comments, clear human-readable code, no hard-coded UI strings (ADR 0012, add `de` **and** `en`), permission checks only via the shared guard (docs/architecture/permissions.md). Read the referenced ADRs before starting.*

fable-5 added this to the M8 — Self-hosting & operations milestone 2026-07-04 14:52:44 +02:00

fable-5 added the

docs

backend

frontend

labels 2026-07-04 14:52:44 +02:00

fable-5 referenced this issue

2026-07-04 14:52:48 +02:00

Release process and Prod stage provisioning #89

fable-5 referenced this issue from a commit

2026-07-11 16:40:07 +02:00

Add instance legal pages with public rendering and footer links (#82)

fable-5 commented

2026-07-11 16:50:22 +02:00

Implemented in fd2bdb3 — pipeline fully green (8 contexts), verified live on Test (/api/v1/legal/privacy serves the localized notice document with footer links; JSON reports configured:false until texts are added).

Settings: two new Markdown instance settings legal.imprint / legal.privacyPolicy in the typed registry — they ride the existing PATCH /admin/settings (SiteAdminGuard) with no new write endpoint. A new “Legal pages” admin section edits both with a toggleable rendered preview that uses the same shared pipeline the server renders with (markdown → schema doc → escaped HTML, security.md §Content) — covered by an api test proving stored <script>/onerror markup survives only as inert escaped text.

Public rendering: /legal/imprint and /legal/privacy as SPA routes (no session) plus, like #56, self-contained server-rendered HTML documents under /api/v1/legal/:kind. The endpoints are @SetupExempt — legal information stays reachable even while the first-run wizard (#80/#81) is pending. Unknown kinds 404.

Footer everywhere (AC): new Footer in AppLayout covers every SPA view — editor, auth screens, and the #56 public page view. The server-rendered documents share a new public/html-shell.ts (extracted from #56’s inline shell) that adds the same links and now renders its chrome in the instance default locale (ADR 0012).

Unconfigured ≠ missing (AC): pages render a localized notice for visitors, and Site Admins additionally get a warning banner linking to the settings — asserted in e2e for both audiences.

Template (AC): docs/self-hosting/legal-template.md ships imprint + privacy-policy templates in de and en whose sections mirror the implemented processing activities, with a review checklist table (accounts, sessions, rate-limit IPs, proxy logs, transactional mail, content/uploads, data export #68, deletion/pseudonymization #59, no third-party requests) anchored to security.md §Privacy. dorfteich.online’s real texts remain a #89 go-live item.

Tests: legal.e2e.db.test.ts (4) + new CI legal pack legal.spec.ts (4: footer navigation from the login screen, visitor notice, admin banner, and the admin form previewing + publishing a text end to end); the reshaped #56 shell is regression-covered by the existing public suites.

Implemented in fd2bdb3 — pipeline fully green (8 contexts), verified live on Test (`/api/v1/legal/privacy` serves the localized notice document with footer links; JSON reports `configured:false` until texts are added). **Settings:** two new Markdown instance settings `legal.imprint` / `legal.privacyPolicy` in the typed registry — they ride the existing `PATCH /admin/settings` (SiteAdminGuard) with no new write endpoint. A new **“Legal pages” admin section** edits both with a toggleable rendered preview that uses the same shared pipeline the server renders with (markdown → schema doc → escaped HTML, security.md §Content) — covered by an api test proving stored `<script>`/`onerror` markup survives only as inert escaped text. **Public rendering:** `/legal/imprint` and `/legal/privacy` as SPA routes (no session) plus, like #56, self-contained server-rendered HTML documents under `/api/v1/legal/:kind`. The endpoints are `@SetupExempt` — legal information stays reachable even while the first-run wizard (#80/#81) is pending. Unknown kinds 404. **Footer everywhere (AC):** new `Footer` in `AppLayout` covers every SPA view — editor, auth screens, and the #56 public page view. The server-rendered documents share a new `public/html-shell.ts` (extracted from #56’s inline shell) that adds the same links and now renders its chrome in the instance default locale (ADR 0012). **Unconfigured ≠ missing (AC):** pages render a localized notice for visitors, and Site Admins additionally get a warning banner linking to the settings — asserted in e2e for both audiences. **Template (AC):** `docs/self-hosting/legal-template.md` ships imprint + privacy-policy templates in **de and en** whose sections mirror the implemented processing activities, with a review checklist table (accounts, sessions, rate-limit IPs, proxy logs, transactional mail, content/uploads, data export #68, deletion/pseudonymization #59, no third-party requests) anchored to security.md §Privacy. dorfteich.online’s real texts remain a #89 go-live item. **Tests:** `legal.e2e.db.test.ts` (4) + new CI **legal pack** `legal.spec.ts` (4: footer navigation from the login screen, visitor notice, admin banner, and the admin form previewing + publishing a text end to end); the reshaped #56 shell is regression-covered by the existing public suites.

fable-5 closed this issue

2026-07-11 16:50:22 +02:00

fable-5 referenced this issue

2026-07-12 00:23:55 +02:00

Release process and Prod stage provisioning #89

fable-5 referenced this issue from a commit

2026-07-12 19:00:07 +02:00

Legal texts for dorfteich.online; legal template covers the newer processing

Sign in to join this conversation.